Patch to avoid MAC header logging

Patch to avoid MAC header logging

[PedroRibeiro (B)]

I hope this is the right place to post this patch I'v made ...

My problem was that logs generated by "-j LOG" being full of mac
headers that didn't have any information to me (the machine is after a
router, so the MAC source is always from the router).

Excess of redundant information is misinformation to me ...

So I'v decided to make this small (tiny) modifications to the LOG
module, adding a flag to disable MAC headers logging.
I'm sure this will make other people happy too.

Fallows the patch to the kernel and to userland iptables command.

################## This one is for the Iptables 1.2.9 ###########

diff -wurNbB iptables-1.2.9/extensions/libipt_LOG.c iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c
--- iptables-1.2.9/extensions/libipt_LOG.c      2003-08-23 12:09:22.000000000 +0100
+++ iptables-1.2.9-IPLNet-2/extensions/libipt_LOG.c     2003-11-12 22:33:52.000000000 +0000
@@ -21,7 +21,8 @@
 " --log-prefix prefix          Prefix log messages with this prefix.\n\n"
 " --log-tcp-sequence           Log TCP sequence numbers.\n\n"
 " --log-tcp-options            Log TCP options.\n\n"
-" --log-ip-options             Log IP options.\n\n",
+" --log-ip-options             Log IP options.\n\n"
+" --log-mac-header             Log MAC header.\n\n",
 IPTABLES_VERSION);
 }
 
@@ -31,6 +32,7 @@
        { .name = "log-tcp-sequence", .has_arg = 0, .flag = 0, .val = '1' },
        { .name = "log-tcp-options",  .has_arg = 0, .flag = 0, .val = '2' },
        { .name = "log-ip-options",   .has_arg = 0, .flag = 0, .val = '3' },
+       { .name = "log-mac-header",   .has_arg = 0, .flag = 0, .val = '4' },
        { .name = 0 }
 };
 
@@ -168,6 +170,15 @@
                *flags |= IPT_LOG_OPT_IPOPT;
                break;
 
+       case '4':
+               if (*flags & IPT_LOG_MAC)
+                       exit_error(PARAMETER_PROBLEM,
+                                  "Can't specify --log-mac-header twice");
+
+               loginfo->logflags |= IPT_LOG_MAC;
+               *flags |= IPT_LOG_MAC;
+               break;
+
        default:
                return 0;
        }
@@ -211,6 +222,8 @@
                        printf("tcp-options ");
                if (loginfo->logflags & IPT_LOG_IPOPT)
                        printf("ip-options ");
+               if (loginfo->logflags & IPT_LOG_MAC)
+                       printf("mac-header ");
                if (loginfo->logflags & ~(IPT_LOG_MASK))
                        printf("unknown-flags ");
        }
@@ -238,6 +251,8 @@
                printf("--log-tcp-options ");
        if (loginfo->logflags & IPT_LOG_IPOPT)
                printf("--log-ip-options ");
+       if (loginfo->logflags & IPT_LOG_MAC)
+               printf("--log-mac-header ");
 }

################## This one is for the Linux kernel 2.4.x ###########
 
diff -wurNbB linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h
--- linux-2.4.22/include/linux/netfilter_ipv4/ipt_LOG.h 2000-03-17 18:56:20.000000000 +0000
+++ linux-2.4.22pr1/include/linux/netfilter_ipv4/ipt_LOG.h      2003-11-12 22:22:02.000000000 +0000
@@ -4,7 +4,8 @@
 #define IPT_LOG_TCPSEQ         0x01    /* Log TCP sequence numbers */
 #define IPT_LOG_TCPOPT         0x02    /* Log TCP options */
 #define IPT_LOG_IPOPT          0x04    /* Log IP options */
-#define IPT_LOG_MASK           0x07
+#define IPT_LOG_MAC            0x08    /* Log MAC header */
+#define IPT_LOG_MASK           0x0F
 
 struct ipt_log_info {
        unsigned char level;

diff -wurNbB linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c
--- linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c   2002-02-25 19:38:14.000000000 +0000
+++ linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c        2003-11-12 22:37:27.000000000 +0000
@@ -289,7 +289,7 @@
               loginfo->prefix,
               in ? in->name : "",
               out ? out->name : "");
-       if (in && !out) {
+       if (in && !out && (loginfo->logflags & IPT_LOG_MAC)) {
                /* MAC logging for input chain only. */
                printk("MAC=");
                if ((*pskb)->dev && (*pskb)->dev->hard_header_len && (*pskb)->mac.raw != (void*)iph) {
 
-- 
Best regards,
 PedroRibeiro                          mailto:pribeiro-bulk@net.ipl.pt

Re: Patch to avoid MAC header logging

[Roberto Nibali]

Hello,

just my two cents ...

> I hope this is the right place to post this patch I'v made ...

Yes.

> My problem was that logs generated by "-j LOG" being full of mac
> headers that didn't have any information to me (the machine is after a
> router, so the MAC source is always from the router).

Fair enough.

> Excess of redundant information is misinformation to me ...

Ok.

> So I'v decided to make this small (tiny) modifications to the LOG
> module, adding a flag to disable MAC headers logging.

Hmm, the way I see it you added a feature to enable MAC header logging 
and disabled it by default.

> I'm sure this will make other people happy too.

Not me ;).

> +       case '4':
> +               if (*flags & IPT_LOG_MAC)
> +                       exit_error(PARAMETER_PROBLEM,
> +                                  "Can't specify --log-mac-header twice");

Side comment: Why? I mean you just copied what was there already, but 
why is this a problem? Setting a flag a thousand times doesn't change 
the end result of the flag being set. Am I missing something design wise?

> diff -wurNbB linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c
> --- linux-2.4.22/net/ipv4/netfilter/ipt_LOG.c   2002-02-25 19:38:14.000000000 +0000
> +++ linux-2.4.22pr1/net/ipv4/netfilter/ipt_LOG.c        2003-11-12 22:37:27.000000000 +0000
> @@ -289,7 +289,7 @@
>                loginfo->prefix,
>                in ? in->name : "",
>                out ? out->name : "");
> -       if (in && !out) {
> +       if (in && !out && (loginfo->logflags & IPT_LOG_MAC)) {

Your new default (IPT_LOG_MAC unset) breaks existing userland tools that 
depend on this output for parsing and further correlation.

Best regards,
Roberto Nibali, ratz
-- 
echo 
'[q]sa[ln0=aln256%Pln256/snlbx]sb3135071790101768542287578439snlbxq' | dc